AhsayCBS flaws exploited in the wild, no patch available

Attackers are chaining two unpatched vulnerabilities in AhsayCBS, a cloud backup server management console, to run code remotely on exposed systems, according to Huntress.

AhsayCBS is developed by Ahsay Systems. It gives administrators one place to manage backup policies, storage and users, and it is widely used by managed service providers (MSPs) and system integrators. A compromise can therefore affect more than a single organization.

Two bugs, one chain

The flaws are tracked as CVE-2026-105133 and CVE-2026-105134. Both let attackers tamper with arguments passed to certain functions in the software. One leads to an authentication bypass and the other to OS command injection.

The issues became public on October 4, when NIST warned that exploit code had been released and that all AhsayCBS versions up to 10.3.2 were vulnerable. On Thursday, Huntress reported that the flaws are being exploited in the wild and that the latest release, version 10.3.4, is also affected. There is no fix yet.

"Until a patch is available, we recommend restricting access to the management interface and investigating for signs of compromise," Huntress said.

As of October 8, the company had seen at least five organizations targeted. "Huntress observed threat actors exploiting the vulnerabilities to gain unauthenticated remote code execution and deploy webshells on exposed systems," the firm noted.

A random token instead of credentials

Huntress singled out CVE-2026-105134, which can be abused for unauthenticated remote code execution with System privileges through an API in the Replication Receiver component.

"The API contains an authentication bypass that could allow for a random token to substitute valid credentials. After exploitation, a threat actor configured a malicious receiver and dropped a Java Server Page (JSP) webshell into the application directory served by the CBS application," the company explained.

Miners dressed up as Microsoft Edge

Once inside, the attackers ran reconnaissance and installed XMRig cryptominers disguised as Microsoft Edge. The same pattern of hijacking exposed servers for cryptomining has shown up in other recent campaigns.

They also dropped an AI-assisted PowerShell script that watches Task Manager and kills it if it stays open too long. This makes it harder for an administrator to spot the miner's resource usage.

For persistence, the attackers created a Windows service posing as Microsoft Edge Update. The service runs a modified copy of NSSM, a legitimate service manager, renamed to msedge.exe and running with System privileges.

"NSSM can support other programs to ensure they stay running and restart after a crash or reboot, and threat actors in this incident likely used it to maintain persistence for edge.exe, while disguising the service-related binary as a legitimate-looking file," Huntress said.

In one intrusion, the attackers also loaded WinRing0x64.sys. This kernel driver is legitimate but vulnerable, and it gave the miner kernel-level access.

Limit who can reach the console

Because the exploit targets the externally accessible web application, Huntress advises cutting off public access to the management interface.

"Organizations should restrict AhsayCBS management interface web access, as the exploit targets the externally accessible web app service on the host. Access should be limited to trusted IP addresses only or require VPN," the company recommends.

Administrators should also check for unknown JSP files in the application directory, unexpected replication receivers, and services or binaries using Microsoft Edge names in unusual locations.

Our Take

This case fits a pattern seen many times this year: public exploit code first, then active attacks, while defenders are still waiting for a fix. Here the gap is worse than usual, because the newest version is also vulnerable. For now, network restrictions are the only real defense.

The MSP angle matters. Backup consoles hold privileged access to customer data, and tools trusted by service providers have long been attractive targets. Huntress has also reported that RMM abuse appears in 45% of its endpoint incidents. The attacks seen so far appear to be about cryptomining. However, webshells with System privileges could just as easily be used for data theft or ransomware.

It is worth watching how quickly Ahsay Systems ships a patch, whether the number of victims grows beyond the five organizations seen so far, and whether other groups pick up the public exploit code.